Network packet traffic analysis may be performed in a number of different ways: the analysis may be performed in real time (on-line) or from stored data (off-line) and the data analyzed may represent a substantially complete record of packet activity or the data may be sampled from the network and therefore represent only a small fraction of the packets in the network. A substantially complete record of packet activity is known as a trace.
A capturing agent may be used to capture a trace by capturing data and storing it on disk. Where the speed at which data arrives exceeds the speed that the data can be written to a disk, packets may be truncated and truncated packets stored. Each truncated packet is shorter than a complete packet and comprises the front portion of a packet without the end portion of the packet. The length of the truncated packet is known as the snap-length. Having captured a trace, the data may be analyzed in many different ways and many different aspects of the data may be investigated.
Typically a trace comprises complete or truncated packets captured over a short period of time or the trace comprises a statistical sampling of the number and temporal distribution of packets sent between machines.
The embodiments described below are not limited to implementations which solve any or all of the disadvantages of known methods of capturing trace data.